Privacy rules now shape how every VoC program collects and stores feedback. Europe has GDPR and California has the CCPA, with more regions adding laws every year. At the same time, the tracking tools many teams relied on are less reliable than they used to be.
Enforcement Is Real
DLA Piper's January 2025 survey found that European regulators issued €1.2 billion in GDPR fines during 2024. Total GDPR fines since 2018 reached €5.88 billion. Ross McKean of DLA Piper said, “I will mostly remember 2024 as the year that GDPR enforcement got personal.”
US regulators are active too
In March 2025, the California Privacy Protection Agency issued its first CCPA final order, fining Honda $632,500. Part of the problem was a cookie tool that made declining harder than accepting. Small design choices can lead to big penalties.
- €1.2 billionin GDPR fines during 2024Source: DLA Piper, January 2025
- €5.88 billionin total GDPR fines since 2018Source: DLA Piper, January 2025
- $632,500Honda fine in the first CCPA final orderSource: California Privacy Protection Agency
Figures as cited in this article
Trust Shapes Feedback
Privacy is also a trust issue. Cisco's 2024 Consumer Privacy Survey found that 75% of consumers won't buy from companies they don't trust with their data. Customers who don't trust you are less likely to share honest feedback.
Be clear about how you use feedback
Tell customers what you collect and why. Keep consent requests simple and make declining as easy as accepting. Our guide to VoC data ethics covers the principles in more detail.
Tracking Is Getting Less Reliable
Third-party cookies have become less dependable for tracking customer behavior. In April 2025, Google said it would keep its current approach to cookie choice in Chrome, leaving the decision with users. Many users block tracking either way. Direct feedback fills the gap.
Lean on first-party signals
The best VoC data comes straight from customers. Surveys and support conversations are first-party sources. Product usage on your own site counts too, as long as you explain it. They're more accurate than inferred behavior and easier to justify under privacy laws.
Cookies versus first-party signals
Third-party cookies
- Less dependable for tracking
- Many users block tracking
- Inferred behavior
First-party signals (the approach the article favours)
- Surveys and support conversations
- Product usage on your own site, explained
- More accurate, easier to justify
Free review snapshot
See what your customers are saying, before you talk to us.
No commitment. We use your details only to send your snapshot and follow up. Privacy policy
Build Privacy Into the Program
Here's where to focus:
- Collect only the feedback data you have a clear use for.
- Remove or mask personal details before broad analysis.
- Set retention limits for raw transcripts and recordings.
- Keep processor contracts up to date with every vendor that touches feedback.
- Honor deletion requests across every system that stores feedback.
Map your data flows
Know where feedback goes after you collect it. Many programs copy data into several tools without tracking it. A simple map makes deletion requests and audits much easier. Update the map whenever you add a new tool. Our post on VoC and CRM integration explains how to keep records connected.
Build privacy into the program
- Collect only data with a clear use
- Mask personal details before broad analysis
- Retention limits for transcripts and recordings
- Up-to-date processor contracts with every vendor
- Honor deletion requests in every system
- Map where feedback flows
Prepare for What's Next
New privacy laws keep arriving, and existing ones keep getting updated. Assign someone to track changes in the regions where you operate. Review your VoC program against new rules at least once a year.
Make privacy a selling point
Customers notice when you respect their data. A clear, simple privacy approach can make people more willing to share feedback. Our guide to feedback deduplication covers cleaning data without exposing personal details. You can analyze feedback with privacy in mind using CSAT analysis, or book a demo.
Frequently asked questions
What is privacy-first VoC?
It's a feedback program designed to collect only what's needed and protect customer data at every step.
Do GDPR and CCPA apply to customer feedback?
Yes. Feedback often contains personal data, so these laws apply to how you collect and store it.
How large are GDPR fines?
European regulators issued €1.2 billion in GDPR fines in 2024 alone.
How does cookieless tracking affect VoC?
It makes inferred behavior less reliable, so direct first-party feedback becomes more valuable.
What's the first step toward privacy-first VoC?
Map where feedback data goes and remove personal details you don't need.
How often should you review privacy practices?
At least once a year, and whenever a new law affects a region where you operate.
